The Data Protection Directive was adopted in 1995 and applies to all EU Member States. Countries had the scope to introduce the requirements into their own laws, which led to some differences between countries. In the UK, the Data Protection Act 1998 replaced earlier legislation such as the Data Protection Act 1984.

In 2012, the European Commission published a draft proposal for a General Data Protection Regulation. Following amendments and discussions between the European Commission, the European Parliament and the Council of the EU, a final version of the General Data Protection Regulation was produced and published in 2016. There was a two-year transition period before it was enforceable. From May 2018, it applies directly to all EU Member States and has an extraterritorial effect.